summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* Security: allow white-listing of installation URLsRobert Griebl5 days7-6/+52
| | | | | | | | | | | | Using the new config field "installer/allowedURLs" you can supply a list of URLs that will be used to filter the accepted URLs by PackageManager::startPackageInstallation(). In the absence of this field, all URLs are accepted as before. Any entry in the list is wildcard-matched, if it contains '*'. Change-Id: Ia289e8cad1f65f17fb397c8044b31a844845faa5 Pick-to: 6.11 Reviewed-by: Dominik Holland <dominik.holland@qt.io>
* CMake: Make the package installation optionalDominik Holland5 days1-0/+1
| | | | | | | | | | A package doesn't exist yet when the install rule is created. Making the install optional fixes this problem. Fixes: QTBUG-129127 Pick-to: 6.11 6.10 6.8 Change-Id: Iff7f28f687b2aca8c104eebbba20c03f75491ac7 Reviewed-by: Robert Griebl <robert.griebl@qt.io>
* CMake: fix FAKEROOT integration to work with pseudoDominik Holland5 days1-2/+9
| | | | | Change-Id: I3fd1a1ddebdabc7085bbab9f35e001b29c09a006 Reviewed-by: Robert Griebl <robert.griebl@qt.io>
* CMake: Add support for using a staging dir when packagingDominik Holland5 days1-3/+27
| | | | | | Task-number: QTBUG-129127 Change-Id: Idadb205ed5fa215ae4c61b0707b73451406be715 Reviewed-by: Robert Griebl <robert.griebl@qt.io>
* CMake: Add support to create package with dev-signaturesDominik Holland5 days1-7/+49
| | | | | Change-Id: I21c9253c0becb0404a6ccfa47139026fa3a3339f Reviewed-by: Robert Griebl <robert.griebl@qt.io>
* Prevent future compatibility breaks by fixing QDataStream versionsRobert Griebl6 days4-0/+7
| | | | | | Pick-to: 6.11 Change-Id: I045672c8e17d76c0407f854d2bffbf8d52b967cb Reviewed-by: Bernd Weimer <bernd.weimer@qt.io>
* CMake: fix typo in fakeroot handlingRobert Griebl6 days1-2/+2
| | | | | | Change-Id: I8209941450e9b86c9f11b61d065042f38dffb119 Pick-to: 6.11 Reviewed-by: Bernd Weimer <bernd.weimer@qt.io>
* Prevent duplicte debug output on shutdown in single process modeRobert Griebl7 days1-3/+5
| | | | | | | | | | Due to the timing the single-process runtimes are destructed, the "close reason" message was printed multiple times (up to once for each window and then again up to once for each application) Change-Id: I68a580e01b7554ec8f828cc6d136b680be85ea91 Pick-to: 6.11 Reviewed-by: Dominik Holland <dominik.holland@qt.io>
* ASAN: prevent leak on shutdown, if the controller has a connectionRobert Griebl7 days1-1/+1
| | | | | | Change-Id: I038c2c78ad9984d7561a986a9494c66267de501e Pick-to: 6.11 Reviewed-by: Bernd Weimer <bernd.weimer@qt.io>
* Replace Q_ENUMS with proper declarative, foreign registrationRobert Griebl7 days2-2/+1
| | | | | | Change-Id: I64f22c16417fb826a87e53a5e8d86662a8c8add3 Pick-to: 6.11 Reviewed-by: Bernd Weimer <bernd.weimer@qt.io>
* Refactor packager and controller using a command base classRobert Griebl7 days8-509/+744
| | | | | | | | | | | | | While at it, the new parsePassword function from the controller was moved into the base class as well and put to use in the packager as well. It also received a secure Windows and Unix implementation for readPasswordFromConsole(), that do not echo the password while you are typing. Change-Id: I163b89c253fae2bcc9e558793487e8f886a37ea3 Pick-to: 6.11 Reviewed-by: Bernd Weimer <bernd.weimer@qt.io>
* Fix long-standing race condition in the Unix signal handlerRobert Griebl7 days4-117/+121
| | | | | | | | | | | | | | | | | | | | | | The available signal handlers were stored in a list, but this is inherently not async-signal-safe. It was giving us the flexibility to have multiple signal handlers installed for a single signal, but in practice this is not a requirement at all and was never used. The new solution is to use a static array of SigHandler*, one handler per signal (ideally, we would store each std::function inside an atomic, but that is not possible). Removal of signal handlers is tricky even with atomics, because signal handlers block the current thread completely. This means we cannot delete a removed SigHandler instance immediately, but we can safely do so after a grace period (currently set to 10min). Also marked all libc and kernel functions with '::', as is the case in the rest of the AM source code. Change-Id: Ibd79fd489dc9d4db8edbf569f7ce29dee30c8d02 Pick-to: 6.11 Reviewed-by: Bernd Weimer <bernd.weimer@qt.io>
* YAML: Add support for version 1.2 document parsingRobert Griebl7 days11-242/+420
| | | | | | | | | | | | | | | | | | | | | YAML 1.2 was specified in 2009 and 1.1 is considered legacy nowadays. The default for parsing and emitting unversioned documents is still 1.1, but you will see warnings for unversioned documents that use features that are not compatible with 1.2. Starting with AppMan 6.12, the default will switch over to 1.2 for unversioned documents. In addition all tags from the core schema are now correctly applied to both 1.1 and 1.2 documents. Version 1.1 will still be supported in the future for explicitly versioned documents. Change-Id: I6c9920784c8f7650d7e63f2273773d7fa462fe9a Pick-to: 6.11 Reviewed-by: Bernd Weimer <bernd.weimer@qt.io>
* Windows: adapt to the new DLL setupRobert Griebl7 days1-12/+57
| | | | | | | | | | | | | - Our structured-exception handler was effectively disabled by the CRT due to a changed call order for static constructors - RaiseException() to re-throw exceptions does not work across modules for some arcane reason, but calling the compiler-internal wrapper CxxThrowException still does. Change-Id: I2dbfe10e014fb41a030ca0ce9f81101e9aef99ec Pick-to: 6.11 Reviewed-by: Bernd Weimer <bernd.weimer@qt.io>
* Clang-tidy / ClazyRobert Griebl7 days104-581/+565
| | | | | | | | It's been a long time since the last round, so there are a lot of fixes Change-Id: Ic226130eed0d03776749a2a04806efaa537f3f19 Pick-to: 6.11 Reviewed-by: Bernd Weimer <bernd.weimer@qt.io>
* Re-organize the appman libraries into more manageable chunksRobert Griebl7 days248-998/+749
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is part 2 of this patch series. Part 1 was about converting the libs from static to shared. This patch now consolidates the library zoo into more manageable and logical chunks. Plus this will also help with keeping the hit to the startup performance (incurred by part 1) in check. The new setup closely follows the QML module nomenclature, but needs to account for the tool builds as well. The new libs are: - Common no changes - Package a combination of Package, Application and Crypto - Shared renamed from SharedMain and combined with Monitor and IntentClient - SystemUI renamed from Main and combined with Manager, DBus, IntentServer and Window - Application renamed from ApplicationMain Because the CrashHandler is using a "constructor" function, it had to be moved from the Common to the Shared lib to avoid having the custom crash handler also in the tools, as they need to install their own CTRL+C handler at times. In addition the 3 QML import modules are now built as official QML plugins and they are installed into $QTDIR/qml as any other import library. NB! There is a problem we still have to solve: custom appman binaries (system-ui's) are currently built by linking against Qt::AppManMain, but this no longer exists. It would be ideal if we could add an alias here. The other renamed modules are not that problematic, as they shouldn't be used outside of the appman project itself. If an alias is not possible, a dummy library which depends on the new "SystemUI" one should also do the trick. Change-Id: Id07e05a523c48e773c295c5be2f27804229155e0 Pick-to: 6.11 Reviewed-by: Bernd Weimer <bernd.weimer@qt.io>
* Change all appman libraries to use Qt's default regarding shared/staticRobert Griebl7 days182-413/+525
| | | | | | | | | | | | | | | | | | | | | | | | | | The idea of using static libraries only was to shave off any milli-second possible from the startup time. This does bring a lot of problems though, in that a lot of valid use-cases where you need access to an internal symbol are not possible, because you cannot link to the static libraries from a Qt or QML plugin, because you get duplicate symbols. As we need the possibility to access Appman symbols from auto-generated plugins for a new intent overhaul, we are doing 2 things now: 1) This patch will simply convert the existing libs over to building as static/shared, depending on how Qt itself was built. 2) The follow-up patch will consolidate the library zoo into more managable and logical chunks. Plus this will also help with keeping the hit to the startup performance in check. A few destructors used in std::unique_ptrs had to made explicit to make MSVC happy. Change-Id: I1bdbb6d8f4c16a6bf70bd98b9a146203d9036a57 Pick-to: 6.11 Reviewed-by: Bernd Weimer <bernd.weimer@qt.io>
* Require SSL support for buildingRobert Griebl13 days1-1/+1
| | | | | | | | | | We could get away with just disabling the installer part before the development-mode revamp, but we now have the Certificate type in the PackageManager QML API. Change-Id: If805ac076e7a25a5c65ab4b630c8ba6faed7530a Reviewed-by: Volker Hilsheimer <volker.hilsheimer@qt.io> Reviewed-by: Bernd Weimer <bernd.weimer@qt.io>
* processtitle: avoid using kernel typesSamuli Piippo2025-12-011-5/+5
| | | | | | | | Avoid using kernel types (__u64) that are not available for user space with musl c library. Change-Id: Iccb059b72a83c6338fe7f043bcb70f6d627145fa Reviewed-by: Robert Griebl <robert.griebl@qt.io>
* Examples: fix the package-installation for cross-buildsRobert Griebl2025-11-242-9/+11
| | | | | | | | | | | | | | | 1) Do not compile in absolute paths from the build environment when cross compiling. Yocto does not like that, plus it just is useless anyway. 2) Tell the user that he needs to start the appman-package-server on his desktop machine for the example to work. 3) Switch the appman-package-server from being an 'app' to being a 'tool', as it is only meant to be used on a development machine. Change-Id: I5f159fafb38aac17f04f73f27405b6ddb8fd6698 Reviewed-by: Dominik Holland <dominik.holland@qt.io>
* StartupTimer: use qCInfo instead of stderr for default outputRobert Griebl2025-11-205-13/+47
| | | | | | | | This allows us to have the report nicely in journald including all the meta-data. Change-Id: Ibd9e11cafc3722abbb5848aa9ffa9bc68aba2d4e Reviewed-by: Bernd Weimer <bernd.weimer@qt.io>
* Fix potential nullptr access when the QML context looses its engineRobert Griebl2025-11-202-9/+8
| | | | | | | | | | Instead of ensuring the validity of the engine pointer, we simply reimplement that part using Quick's C++ API. This way we don't have to worry about the actual engine pointer at all. Change-Id: Ife75b9f227a36f6e2ccd97b4f41318846d6db062 Pick-to: 6.10 6.8 Reviewed-by: Dominik Holland <dominik.holland@qt.io>
* Export Certificate to QMLRobert Griebl2025-11-196-4/+31
| | | | | Change-Id: Id8bdb0e09d2e3ecf9513ec227bd6fe724e28e2e7 Reviewed-by: Dominik Holland <dominik.holland@qt.io>
* Make "allowUnsignedPackages" work in "Application" development modeRobert Griebl2025-11-191-1/+11
| | | | | | | | | | | | When allowUnsignedPackages is set, packages installed via the development p2p bus are still checked if the package-id is allowed via the installed developer certificate. This makes it possible to run without signatures, but still restrict 3rd party developers to their assinged package-ids. Change-Id: I34181248b4794951157faa97ac7eed9368f39f79 Reviewed-by: Dominik Holland <dominik.holland@qt.io>
* Better watchdog support for quick-launchers and containersRobert Griebl2025-11-194-27/+51
| | | | | | | | | | | | - Quick-launchers should not, but can open windows and thus trigger the watchdog. We will now report them as such. - Container solutions that bundle multiple applications under one PID were not supported correctly, as the application <-> PID mapping was only updated when a new window was being created. Change-Id: I29343f3277c1e63cf2ffa66ff95dca991980c715 Reviewed-by: Dominik Holland <dominik.holland@qt.io>
* Doc: add documentation for CertificateRobert Griebl2025-11-192-0/+106
| | | | | Change-Id: I5a6f0fcf81a9eddc87c66e9dbd09e3c83cd38f6c Reviewed-by: Dominik Holland <dominik.holland@qt.io>
* Doc: fix documentation and error messagesRobert Griebl2025-11-191-1/+6
| | | | | Change-Id: I71d232c7abab7b6dbd4da04a3e470b2b2ddd682a Reviewed-by: Dominik Holland <dominik.holland@qt.io>
* Better and more secure password options for appman-controllerRobert Griebl2025-11-191-14/+86
| | | | | | | | | | | Also added documentation for the new commands. The '--password stdin' option needs improvement, but this should be done in conjunction with switching the packager over to this style of password parsing. Change-Id: I2601e0bfca12c578b9c6cdc6b930523c1f260fae Reviewed-by: Dominik Holland <dominik.holland@qt.io>
* Fix broken DBus access check for setDeveloperCertificateRobert Griebl2025-11-183-7/+17
| | | | | Change-Id: Ifb1d7f8dae3d41c5c9a3ba6af85d54f77b58fa85 Reviewed-by: Dominik Holland <dominik.holland@qt.io>
* Bubblewrap: do not fail, if there is no session-busRobert Griebl2025-11-181-3/+5
| | | | | | Pick-to: 6.10 6.8 Change-Id: I7502184d31befdd06e4607067efd0464408a9104 Reviewed-by: Dominik Holland <dominik.holland@qt.io>
* Workaround for QtDBus-internal race conditionRobert Griebl2025-11-181-0/+5
| | | | | | | | | | | | | When sending file-descriptors (argument of type 'h') as the first thing after connecting to an P2P server, the connection sometimes gets disconnected from the client side while libdbus is in the middle of negotiating the "can-send-fds" capability. Retrieving a property first gets rid of this problem consistently. Change-Id: I2d5daaa434d4199ba1e55d08856d2f5f6e3a232d Pick-to: 6.10 6.8 Reviewed-by: Dominik Holland <dominik.holland@qt.io>
* DBus P2P: prevent FD leakRobert Griebl2025-11-181-0/+10
| | | | | | | | | QtDBus will not free D-Bus resources when a peer disconnects and to make matters worse, there isn't even a signal to get notified. Pick-to: 6.10 6.8 Change-Id: I34e06ad6d603a939a873af602291463a155d4abf Reviewed-by: Dominik Holland <dominik.holland@qt.io>
* ProcessTitle: fix kernel config checksRobert Griebl2025-11-181-1/+2
| | | | | Change-Id: Ib337472b9a9118d9630014ad231f4305b5197a33 Reviewed-by: Dominik Holland <dominik.holland@qt.io>
* Intents: fix race when an app is removed during an intent operationRobert Griebl2025-11-052-9/+3
| | | | | | Change-Id: Ifa0d011675cf8eb304d2e9f02791a4598e8918c9 Pick-to: 6.10 6.8 6.5 Reviewed-by: Dominik Holland <dominik.holland@qt.io>
* Improve the DBus policy checksRobert Griebl2025-11-043-57/+63
| | | | | | | | | | Instead of generating the DBus error directly in the DBusPolicy class, we rather throw an exception and let the actual adaptor implementation send the error, where it can also add context to the message. Change-Id: I2081b7e8a49e1f23297777ea5233a4c9c8fc13ce Reviewed-by: Thomas Senyk <thomas.senyk@qt.io> Reviewed-by: Dominik Holland <dominik.holland@qt.io>
* Enable Qt's strict modeRobert Griebl2025-11-0418-46/+44
| | | | | | | | | Instead of a manually updating a bunch of defines for various features, using the single strict mode define is much more convenient going forward. Change-Id: Idc6fd51dd8aeb63164ef4e0ed302c97f9c0fa845 Reviewed-by: Dominik Holland <dominik.holland@qt.io>
* Testrunner: Use declarative registration for the Test moduleRobert Griebl2025-11-044-17/+37
| | | | | | Change-Id: I69ceacb955632045e32d5d7283b8c387d048108f Reviewed-by: Thomas Senyk <thomas.senyk@qt.io> Reviewed-by: Dominik Holland <dominik.holland@qt.io>
* launcher-qml: remove the long deprecated, internal "direct-load" flagRobert Griebl2025-11-043-65/+8
| | | | | Change-Id: I108b3306775529a63cbd579b4d63579b55a6ce9e Reviewed-by: Dominik Holland <dominik.holland@qt.io>
* Remove the unused Cryptography namespaceRobert Griebl2025-11-049-103/+20
| | | | | | Change-Id: I13995026bed54ff82804e862a8ab188ebf172566 Reviewed-by: Thomas Senyk <thomas.senyk@qt.io> Reviewed-by: Bernd Weimer <bernd.weimer@qt.io>
* Tests: better AM_VERBOSE_TEST handlingRobert Griebl2025-11-041-4/+10
| | | | | | | | | | | | | | - Automatically switch on AM_VERBOSE_TEST, if the test was run with the -v1 or -v2 command line option. This makes the Coin re-run of failed tests much more useful, because they are run with -v2. - The check for the command line option was centralized in 2 places: one for C++ and one for QML tests. The C++ one is a bit tricky, as we need to introduce a custom test main macro to get access to argc/argv. Change-Id: I6137297dea97bb9ac4d63e37d2fab306444a2343 Reviewed-by: Bernd Weimer <bernd.weimer@qt.io>
* Controller: add handling for DBus errors on property accessRobert Griebl2025-11-041-0/+12
| | | | | | Change-Id: I795af820ecec3c0c8634377789f800c29a8a8438 Reviewed-by: Thomas Senyk <thomas.senyk@qt.io> Reviewed-by: Dominik Holland <dominik.holland@qt.io>
* Watchdog: make it possible to dump core on watchdog killsRobert Griebl2025-11-046-7/+20
| | | | | | Change-Id: I652cf016e42c76abfa60c70b26a837a74265a66c Reviewed-by: Dominik Holland <dominik.holland@qt.io> Reviewed-by: Thomas Senyk <thomas.senyk@qt.io>
* Tools and Tests: implement and test CRL checking for package signaturesRobert Griebl2025-11-044-9/+32
| | | | | | Change-Id: I30cb8402d5c2a79508a5493d7a2e6b81eaccd077 Reviewed-by: Thomas Senyk <thomas.senyk@qt.io> Reviewed-by: Dominik Holland <dominik.holland@qt.io>
* Cleanup and simplify cryptography.h/.cppRobert Griebl2025-11-044-130/+68
| | | | | | | | | Most importantly, the error number conversion has moved into the respective Exception classes, so it is not needed anymore. Change-Id: I065d2009d6d4cee67338428995312d75e2ba0905 Reviewed-by: Thomas Senyk <thomas.senyk@qt.io> Reviewed-by: Dominik Holland <dominik.holland@qt.io>
* Do not enable external D-Bus interfaces by defaultRobert Griebl2025-11-0421-444/+288
| | | | | | | | | | | | | | | | | | | | | By moving the notifications to a private interface on the per-app P2P bus, we can now get rid of the "auto" session-bus that had to be started to enable notifications. This "auto" mechanism also registered all the other singleton interfaces on this session-bus, giving every app access to all the appman functionality by default. This patch now gets rid of the "auto" session-bus completely and defaults the dbus registrations to "none", meaning the user has to explicitly enable access to the singletons via the configuration. Also, the p2p development bus is now only started, when the developmentMode is explicitly set to 'system' or 'application'. Change-Id: I2335d89c02c9b34b0804d3770ba2afd1c226b774 Reviewed-by: Thomas Senyk <thomas.senyk@qt.io> Reviewed-by: Dominik Holland <dominik.holland@qt.io>
* Implement DBus checks for development-mode, part 1Robert Griebl2025-11-049-285/+589
| | | | | | | | | | | | | | All calls coming into the AM and PM DBus adaptors are checked: - when coming in from an external bus, we do the existing policy checks - when coming in from the development P2P bus, we check if the caller has actually access to requested resource based on the current development-mode setting. Part 2 will be the checks for outgoing signals and property access. Change-Id: Idcac10137b7412802e6aca74cb2a37350298923f Reviewed-by: Dominik Holland <dominik.holland@qt.io>
* Improve development modeRobert Griebl2025-11-0416-122/+443
| | | | | | | | | | | | | | | | - The developmentMode true/false flag is now extended to three values: 'disabled', 'system' (full access like the old 'true' mode) and the new 'application' mode - The 'application' mode needs a valid developer certificate to activate (via the appman-controller tool or DBus) - When in this mode, the developer has very restricted access to apps, packages and installation tasks. Change-Id: Ie45aa8d230a9c109aa944c400c1405cf6b2415bb Reviewed-by: Dominik Holland <dominik.holland@qt.io> Reviewed-by: Thomas Senyk <thomas.senyk@qt.io>
* Windows: improve package signaturesRobert Griebl2025-11-041-155/+357
| | | | | | | | This adds the Windows specific API adaptions to the previous commit Change-Id: Ie0777fcee886a3015651b0ebf2c06098fb086b1b Reviewed-by: Dominik Holland <dominik.holland@qt.io> Reviewed-by: Thomas Senyk <thomas.senyk@qt.io>
* macOS: improve package signaturesRobert Griebl2025-11-045-197/+103
| | | | | | | | | | | | | | | This switches the backend used on macOS from Apple's SecurityFramework to libressl 3.3.6 which comes preinstalled on macOS 12+. There are 2 reasons for this: 1) Because of https://openradar.appspot.com/FB8988319, we cannot use SHA-256 based PKCS#12 containers on macos 13 and 14. 2) Apple removed all local CRL support for X509 certificate verification when switching to their SecurityFramework Change-Id: Ib48a939928701404f7e381fcb9e6ccbd718e0561 Reviewed-by: Dominik Holland <dominik.holland@qt.io> Reviewed-by: Thomas Senyk <thomas.senyk@qt.io>
* OpenSSL: improve package signaturesRobert Griebl2025-11-047-149/+357
| | | | | | | | This adds the OpenSSL specific API adaptions to the previous commit Change-Id: I1fa8ce956920c7541ac826a798205f0d7bae9df6 Reviewed-by: Dominik Holland <dominik.holland@qt.io> Reviewed-by: Thomas Senyk <thomas.senyk@qt.io>
generated by cgit v1.2.3 (git 2.25.1) at 2025-12-16 10:30:27 +0000